Permission to download webform attachments

Generally, we'd implement the Webform access rules and webform submission access api. It does feel "clunky" though rather than just a singular hook during submission access to modify.

Perhaps we just make this generic. We implement the access method in the MaestroWebformHandler which just does a hook invocation.

This way you can code up any sort of check and return value and we just pass that along as the return from the access method. We'd return Neutral as a default.

I decided to revisit this. This time I was able to get hook_webform_submission_access() working. I thought I'd share it in case it's useful for anyone else.

use Drupal\Core\Access\AccessResult;
use Drupal\Core\Session\AccountInterface;
use Drupal\maestro\Engine\MaestroEngine;
use Drupal\maestro_webform\Plugin\EngineTasks\MaestroWebformTask;
use Drupal\webform\WebformSubmissionInterface;

/**
 * Implements hook_webform_submission_access().
 */
function mi_workflow_webform_submission_access(WebformSubmissionInterface $webform_submission, $operation, AccountInterface $account) {
  // Only allow them to view the submission - not edit or delete it
  if ($operation !== 'view') {
    return AccessResult::neutral();
  }

  // If no-one is logged in, there's nothing for us to check
  if ($account->isAnonymous()) {
    return AccessResult::neutral()->addCacheContexts(['user']);
  }

  // Only give access to the file downloads, not the submission itself
  if (Drupal::routeMatch()->getRouteName() !== 'system.files') {
    return AccessResult::neutral()->addCacheContexts(['user', 'route']);
  }

  // Look for related Webform tasks assigned to the user
  $submission_id = $webform_submission->id();
  $queue_ids = MaestroEngine::getAssignedTaskQueueIds($account->id());

  foreach ($queue_ids as $queue_id) {
    // Check if this is a Webform task
    $template_task = MaestroEngine::getTemplateTaskByQueueID($queue_id);
    if (!$template_task) {
      continue;
    }

    $plugin_task = MaestroEngine::getPluginTask($template_task['tasktype']);
    if (!($plugin_task instanceof MaestroWebformTask)) {
      continue;
    }

    // Check if the submission ID matches
    $process_id = MaestroEngine::getProcessIdFromQueueId($queue_id);
    if (!$process_id) {
      continue;
    }

    $queued_submission_id = MaestroEngine::getEntityIdentiferByUniqueID($process_id, $template_task['data']['unique_id']);

    if ($queued_submission_id === $submission_id) {
      return AccessResult::allowed()->addCacheContexts(['user', 'route']);
    }
  }

  return AccessResult::neutral()->addCacheContexts(['user', 'route']);
}

Glad you were able to sort it out and thanks for posting your solution.